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ABSTRACT 

As the assembly of the ISS nears completion, it is worthwhile to step back and review some of 
the actions pursued by the Program in recent years to reduce risk and enhance the safety and 
health of ISS crewmembers, visitors, and space flight participants. While the initial ISS 
requirements and design were intended to provide the best practicable levels of safety, it is 
always possible to further reduce risk - given the determination, commitment, and resources to 
do so. The following is a summary of some of the steps taken by the ISS Program Manager, by 
our International Partners, by hardware and software designers, by operational specialists, and 
by safety personnel to continuously enhance the safety of the ISS, and to reduce risk to all 
crewmembers. 

While years of work went into the development of ISS requirements, there are many things 
associated with risk reduction in a Program like the ISS that can only be learned through actual 
operational experience. These risk reduction activities can be divided into roughly three 
categories: 

• Areas that were initially noncompliant which have subsequently been brought into 
compliance or near compliance (i.e.. Micrometeoroid and Orbital Debris [MMOD] 
protection, acoustics) 

• Areas where initial design requirements were eventually considered inadequate and 
were subsequently augmented (i.e.. Toxicity hazard level-4 materials, emergency 
procedures, emergency equipment, control of drag-throughs) 

• Areas where risks were initially underestimated, and have subsequently been addressed 
through additional mitigation (i.e.. Extravehicular Activity [EVA] sharp edges, plasma 
shock hazards) 

Due to the hard work and cooperation of many parties working together across the span of 
more than a decade, the ISS is now a safer and healthier environment for our crew, in many 
cases exceeding the risk reduction targets inherent in the intent of the original design. It will 
provide a safe and stable platform for utilization and discovery for years to come. In the 
following 


sections, we expand on this theme, and discuss in greater detail each of the areas identified 
above, beginning with the ISS acoustic environment. 

1. MMOD 

Many not close to the ISS Program might be alarmed to learn that the current risk of MMOD 
penetrating the pressurized habitable volume of ISS (an actual "through-hole") over a ten year 
period of time is about 50/50... basically, a coin toss. Actually, it is a little worse. It is important 
to note that there are many different case-specific types of "through-holes", and while all 
penetrations are bad, many do not necessarily represent a catastrophic event. With that said, 
MMOD is still a top safety risk for the ISS Program. It is also important to note that from an 
historical perspective, the ISS Program actually baselined requirements that allowed for about a 
25% chance of such a penetration (still a sizable risk); however, that risk posture has slowly 
eroded over the years (see Figurel). 
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When RSA joined the ISS Partnership, the ISS design was changed to include legacy Russian 
modules already in production, and slated for use in the next Russian Space Station. ISS 


configurations and flight attitudes required that these modules take the brunt of the MMOD 
risk. Many discussions ensued as to how to fairly sub-allocate the MMOD risk across the 
integrated vehicle, recognizing the use of legacy modules and the significant difficulties in re- 
design. MMOD risk mitigation typically involves the use of additional layers of shielding, which 
grow the outer mold-line of the module and thereby can create physical packaging issues 
during launch vehicle integration under shrouds with very small clearances. Shielding 
modifications can also affect the optical and thermal properties of the module and thereby 
force significant analysis to verify continued compliance with other performance requirements. 
On-orbit shielding modification is possible, and we have done it, but it requires the design and 
fabrication of EVA-installable shields, critical up-mass sacrifices, and finally the execution of 
significant EVA tasks. Suffice it to say, risk mitigation in the world of MMOD is rather 
cumbersome and expensive. Furthermore, MMOD risks are primarily statistical in nature, and 
it is sometimes difficult to get an intuitive feel for the true level of risk associated with particles 
of various size and material properties impacting the vehicle in various ways, and causing 
various levels of damage. Depending upon the specifics of the impact and subsequent hole, the 
consequences can range from a small penetration that can be located and patched with little 
impact, to a hole large enough and hidden enough to cause loss of a module through hatch 
isolation, to a hole large enough to force ISS evacuation, and ultimately to near-immediate loss 
of the crew and vehicle. The range of consequences is very dramatic and significant analysis is 
required to understand the likelihood of each threshold being crossed. 

At the same time, our understanding of the MMOD environment has continued to evolve. ISS 
experiments, the return of external hardware with long on-orbit exposure times, and post- 
mission Orbiter inspections all told us that the threat of MMOD was real and getting worse. 
Fairly recently events, such as the intentional destruction of a Chinese satellite and the 
inadvertent collision of two other satellites, were also driving factors for a worsening 
environment. 

So, the ISS Program was left to manage a very significant worsening risk, not only driven by a 
worsening environment and by the increasing size of the vehicle itself, but also a risk that 
required the expenditure of significant resources. As a commendable example of continuous 
risk management, in 2012, our partners will be modifying their Soyuz and Progress visiting 
vehicles, as well as developing and manifesting new Service Module shielding for on-orbit EVA 
installation on the Russian segment. Furthermore, the development of a new on-orbit crew 
"push-button" capability to initiate a preset Debris Avoidance Maneuver (DAM) will eliminate 
the current 24 hour lead time required for orchestrating a DAM and allow the crew to respond 
to late-breaking conjunction threats from tracked debris. These very substantial mitigation 
activities target critical risk areas and will significantly improve the ISS safety risk posture. 



2. ACOUSTICS 

Early in the ISS Program, there was significant concern regarding the long term effects of the ISS 
acoustic environment on crew health. While Program safety requirements dictated the NC-50 
criterion (58 dB averaged over any ten-second period) [1] to provide hearing protection that 
was thought to be technically feasible to achieve, initially there were multiple Noncompliance 
reports (NCR's) required for both the US and Russian segments of the vehicle. Concerns 
included both short-term and long-term hearing degradation, inability to hear both 
conversations and alarms, and psychological stress caused by exposure to excessive noise. 

Early crews were encouraged to wear hearing protection, and both earplugs and headphones 
were provided. Program Management, Safety, and the International Partner community 
worked continuously to build quieter fans, add mufflers, change fan blade materials, and 
otherwise reduce noise. The results of these efforts can be seen in the following diagrams [2] 
and [3]: 
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Acoustic sampling is performed over a wide range of locations in both the US, IP, and Russian 
Segments of the ISS, and these charts represent only a sample. But note the significant 
reductions achieved over time, particularly in the Russian Segment. USOS and IP elements have 
achieved full compliance in many areas, and Russian designers are clearly on track to meet their 
design goals. The graphs above represent over ten years of efforts to bring the ISS acoustic 
environment into compliance with initial design requirements, and indicate that we are on a 
path to success. But more importantly, no reports have been made of any crewmember 
hearing deficits, either short-term or long term. While 100% compliance with the NC-50 criteria 
has not yet been achieved, significant progress has been made toward preserving crew health. 


3. TOXICITY HAZARD LEVEL-4 MATERIALS 


In the closed environment of the ISS, the release of potentially toxic materials constitutes a 
significant risk. Since the earliest days of the program, concerns have been expressed regarding 
the usage and proper containment of especially toxic materials such as ammonia, mercury, and 
lithium compounds such as those found in high energy density batteries. ISS safety 
requirements divide potentially toxic substances into five categories: 

a. Toxicity Hazard Level (THL)- 0 - No hazard ( e.g., the release of small quantities 
of water) 

b. THL-1 - Critical hazard (exposure to minor skin or eye irritants) 

c. THL-2 - Catastrophic hazard (moderate to severe irritation, with the potential 
for long-term injury) 

d. THL-3 - Catastrophic hazard (systemic toxicity with the potential for long-term 
injury or illness from the release of solids or non-volatile liquids) 

e. THL-4 - Catastrophic hazard (same as THL-3 but from the release of a volatile 
liquid, gas, or fumes) 


In 2006, in an effort aimed at vehicle-wide risk reduction, the Program Manager directed that 
all THL- 4 materials be removed from the ISS, as soon as it was possible to do so without 
impacting ongoing investigations. (Many of these items were batteries containing lithium 
thionyl chloride and other lithium compounds.) This effort was begun immediately, and 
completed over the next two years. One may well ask why these items were singled out. After 
all, the same safety requirements were imposed on THL-4 materials as on all other catastrophic 
hazards: two fault tolerance or design to minimum risk (either provide triple [and on-orbit 
verifiable] containment or use a pressure vessel). And the severity of the effect was the same: 
severe injury or death. The key discriminator in this decision was the combination of lethality 
and inadequate crew response capability presented by THL-4 materials. A solid or a non- 
volatile fluid can be safely cleaned up, given the proper crew protection equipment. But a 
battery that vents lithium thionyl chloride into a habitable volume can cause an immediate and 
potentially lethal hazard, and can be extremely difficult to clean up, potentially rendering a 
volume uninhabitable. And while high energy-density batteries are extremely desirable for 
space applications, the Program Manager determined that this was not a risk trade he was 
willing to make. 

Today, our requirements still do not absolutely forbid the use of THL-4 materials. However, 
such usage is strongly discouraged, and the Program Manager has reserved the right to review 
and approve all such proposed applications on a case-by-case basis. Of course, it must be said 



that some THL-4 materials still remain onboard, such as the silica gel in the Vozdukh system. 
Indeed, the biggest such threat is from the ammonia in the US external cooling system. 

Leakage through internal heat exchangers could introduce significant quantities of ammonia 
into the cabin creating a potentially catastrophic hazard. But it is not deemed practicable at 
this time to entertain the idea of changing the basis for external heat rejection in the US 
segment of the ISS. This risk has been accepted. However, that is not to say that no mitigation 
has been attempted. As will be discussed in a later section, ammonia masks have been 
provided and procedures developed for ammonia scrubbing to protect Soyuz egress. 

4. EMERGENCY PROCEDURES 

Crew response to on-orbit emergencies such as fire, toxic release, or depressurization, can be 
complicated and difficult. The changing configuration of the vehicle, the changes in crew size, 
changes in command, and different spaceflight paradigms involved among our diverse crews all 
conspire to make the proper and safe response to a wide variety of emergency scenarios a 
challenging task to implement. We have spent years of discussions with our partners to 
attempt to revise and improve our ability to respond quickly and correctly in emergency 
scenarios to ensure crew safety while doing everything possible to preserve an irreplaceable 
international asset. 

Improvements to emergency response procedures have been made continuously since the 
inception of ISS, but several significant modifications have been made in recent years. 

Although the risk of an ammonia leak into the habitable volume is very low likelihood, several 
years ago emergency response procedures and hardware were developed to attempt to 
adequately protect the crew and vehicle for this scenario. Refinement of the ammonia leak 
response continues still today, with development of ammonia scrubbing procedures for the 
Soyuz vehicles actively in work. Ammonia scrubbing capability for the Soyuz vehicles would 
provide the additional time needed for the crew to perform an orderly undock, rather than an 
immediate undock with ballistic re-entry. When Russian Segment scrubbing capability is 
developed in the future, having a Soyuz "clean zone" will allow the crew to stay on-orbit until it 
is safe to egress the Soyuz vehicle, thus preventing the abandonment of ISS. 

Over the past year there has also been an important update to fire response on ISS. In 2009, 
the Safety & Mission Assurance organization brought forward a risk to the operations 
community regarding use of hardline oxygen during fire response. Use of hardline oxygen 
requires the crew to wear a mask that plugs into the ISS oxygen system to provide breathing 
oxygen to the crewmembers during a fire scenario. Due to the design of the mask, significant 
oxygen leakage from the mask is expected in this scenario and will rapidly increase the oxygen 
concentrations throughout the affected modules. Elevated oxygen concentrations in the 
presence of an active fire is not a safe practice and can perpetuate the fire and endanger the 



crew due to elevated oxygen concentrations around their face mask. To address this risk, fire 
cartridges have been developed to be used with respirators during fire response. 


Over the years that ISS has been in orbit, there has been in an increase in orbital debris and 
therefore, an increase in possible conjunctions with debris. To avoid impacts with debris, it is 
often necessary to perform a debris avoidance maneuver (DAM). However, there are cases 
where a possible conjunction is not identified until it is too late to perform a DAM. This has 
caused ISS crewmembers to take shelter in their Soyuz vehicle twice now (March 2009 and June 
2011). If any of the ISS modules were impacted, sheltering in Soyuz vehicles would keep the 
crew safe in their escape vehicle. Due to lessons learned from the first shelter in place 
occurrence in March 2009 and valuable feedback from crewmembers, training for this case has 
been implemented preflight and agreements have been made with our partners regarding the 
vehicle configuration to reduce risk to the crewmembers in the event of an impact. With 
shelter in place in the Soyuz, the crew is still vulnerable to impacts to the Soyuz vehicle which 
they are sheltering in. To reduce this risk, teams are now looking at developing the capability 
to perform a pre-determined DAM so that in the event of a late conjunction, a DAM can still be 
performed and move the ISS orbit to one that is free of debris and the threat of impact. 

Several other significant updates to emergency procedures are being made, including 
improvement to depressurization response and toxic spill response. An ISS Emergency 
Operations team was formed in 2009 in response to an evaluation of emergency procedures 
prior to increasing the onboard crew complement to 6-person crew. This team is dedicated at 
improving emergency response on ISS for many years to come. 


5. EMERGENCY EQUIPMENT 

The initial ISS design called for the placement of a minimum set of emergency equipment, such 
as fire extinguishers and oxygen breathing masks, in ISS volumes. The quantity and placement 
of this equipment was largely determined by the size of each module. Operational 
requirements developed through experience and lessons learned from on-orbit emergency 
drills have led us to significantly increase the amount of equipment available to the crew, alter 
equipment locations, and develop new pieces of hardware to improve the safety of the crew 
and vehicle during emergency response. 

Prior to increasing the ISS crew complement from a 3-person crew to a 6-person crew in early 
2009, the Safety & Mission Assurance organization performed an assessment of all emergency 
equipment to ensure adequate quantity and locations of emergency hardware throughout ISS 
based on occupancy, emergency response procedures, and likelihood of event. Several 
recommendations resulted from this assessment that were eventually implemented: additional 



US Portable Breathing Apparatus (PBAs) would be necessary to ensure safety in depress and 
fire scenarios, a second ammonia detection kit should be made available to the second Soyuz 
crew (non-prime crew), additional Russian oxygen breathing masks (MnK-lM) should be 
launched to ensure that a minimum of two masks per crewmember are available in case of a 
need to evacuate ISS (protects for Sokul suit donning in a contaminated atmosphere). 

In 2010, all available ground spares of the US portable breathing apparatus (PBA) were 
launched to ISS to ensure as many masks as possible were available to the crew in the event of 
an emergency requiring breathing oxygen. The PBAs were placed strategically near the Russian 
Segment so that if evacuation to the Russian Segment was needed, the crew could bring the 
extra PBAs with them before closing the hatch separating the Russian and US segments. Earlier 
this year, certification of the US PBAs for storage and use on the Russian Segment was a 
milestone and further step towards crew safety by providing more equipment available on the 
Russian Segment and providing unlike redundancy for the Russian oxygen breathing mask 
(MIIK-IM). 

Development of new emergency equipment has also contributed to risk reduction on ISS. In 
2006, ammonia response hardware was developed to protect the crew in the event of an 
internal ammonia leak. Currently in development is a new emergency mask to replace the 
current ammonia respirators, and is a "one size fits all" design that will allow a crewmember to 
grab any mask instead of the particular mask they were fitted for, which will improve safety. 
This mask will also be able to be used in fire response with the addition of filtering smoke 
cartridges connected to the mask. In response to recommended changes in emergency 
response for fire to reduce risk to crew and vehicle, fire cartridges were developed to be used 
with the current ammonia respirators and future emergency mask to be used in place of masks 
that plug into the ISS oxygen system, which can increase the oxygen concentration significantly 
in the cabin during fire response, contributing to an unsafe atmosphere. Development of a new 
fine water mist fire extinguisher is in work to provide more options during fire response and 
provide unlike redundancy to the current C02-based fire extinguisher. This new fine water mist 
fire extinguisher will have benefits over the current C02-based extinguisher since discharge of 
the C02 extinguisher requires breathing protection since C02 displaces oxygen and in large 
amounts can be harmful to the crew. Options for portable atmospheric monitoring equipment 
and thermal cameras are being investigated to further reduce fire response risk onboard. 

We continue to evaluate improvements to emergency equipment. Factors such as crew 
sleeping locations, crew activity level in the different modules, and logistics of emergency 
response are continually being assessed for emergency equipment placement. 



6. DRAG-THROUGHS 


During operations aboard the ISS until 2009, it was common practice to allow the use of drag- 
throughs , that is to say, equipment which required cables, hoses, or wiring to cross the 
threshold of an ISS hatch. Cameras, speakers, ducts, hoses, microphones, computers, lights, 
and many other devices required the use of drag-throughs. Shuttle missions required extensive 
use of drag-throughs, especially through the Pressurized Mating Adaptor-2 to Orbiter Docking 
Assembly hatch. At times there were up to seven drag-throughs penetrating a single hatch. 

(See figure 3). The Program requirement is that a hatch must be able to be closed and latched 
in three minutes. Many drag through's could be easily dragged back through a hatch. Some 
provided quick disconnects on both sides of the hatch interface. Some required the use of 
cutters, which were to be kept near the hatch. And while the Program felt that the three- 
minute requirement could still be met, the Program manager became uncomfortable with the 
proliferation of drag-throughs. The major concern was that during an emergency involving a 
depressurization event, a toxic spill, or a fire, cutting, disconnecting, or otherwise clearing these 
hatches could prove problematic. In these less than ideal circumstances we might well violate 
our three-minute rule. So at the Program Risk Assessment Board in February 2009, Mr. 
Suffredini gave an action to implement a "no drag-through requirement" and to identify ways 
to eliminate the current drag-throughs on ISS. Since then, the number of drag-throughs has 
dropped. Every drag-through now requires an NCR, and those are reviewed thoroughly to 
assure that there is no other possible means of accomplishing the desired function. There are 
still drag-throughs on the ISS, but the Program manager has effectively halted their 
proliferation, and biased designers toward looking for solutions that do not require the 
violation of hatch interfaces. 


Figure 3 




7. EVA SHARP EDGES 

Prior to STS-120/ Flight 10A, there was a rapidly developing concern with respect to out-of- 
family EVA glove damage observed post-EVA (Figure 1). The concern was of catastrophic 
significance, as a through-hole in the EVA glove beyond a specific dimensional threshold would 
result in loss of crew. In some cases, the observed damage had been above or right at the 
threshold of catastrophic concern, but the damage had always been isolated to the outermost 
protective layer. The damage never penetrated deep enough to pierce the thin, sensitive 
pressure bladder layer located just inside the repetitively damaged outermost protective layer, 
and therefore no leaks to the pressurized suit system had been experienced. At the time, large 
uncertainties existed as to the possible proximate causes for the glove damage. Open fault tree 
items ranged from glove workmanship issues to MMOD induced sharp edges on ISS. 




Figure 1: STS-120/10A, Right Glove 

An "overglove" concept (Figure 2), basically a protective mitt worn over the existing EVA gloves, 
was prototyped on a highly accelerated schedule in an attempt to support the quickest possible 
manifesting for interim risk reduction. The overgloves intuitively added an additional layer of 
cut protection, but the crew had not been appropriately trained to use them... and there were 
several other concerns with respect to the cumbersomeness of their use. Flowever, the 
overgloves were used successfully over several EVAs while a more extensive and permanent 
EVA glove modification was completed. 



Figure 2: Overglove shown installed on glove 

With heightened priority, a series of glove modification options were rigorously tested and 
evaluated. The EVA Project Office settled on the addition of a layer of tough "Turtle Skin" 
material to the affected gripping region of the EVA glove. The recognition of a negative safety 
risk trend (despite many years of successful performance) and the subsequent effort to provide 
a more robust EVA glove greatly improved the safety risk posture for all US EVAs. To date, no 
additional cuts or glove damage have been noted post EVA. 

8. PLASMA SHOCK HAZARDS 

It was well understood in the initial ISS design concept that the vehicle would be traveling 
through and interacting with the plasma present in the Earth's ionosphere, and that this could 
create buildups of negative charges, and cause undesirable current paths through the vehicle, 
or arcing to the plasma. Dual PCU's (Plasma Contactor Units) were provided in the spacecraft 




design to ground the vehicle to this plasma environment by discharging streams of electrons. 
This design feature is particularly important in preventing the potential for charge buildup and 
subsequent current flow through crewmembers (resulting in potentially dangerous electrical 
shocks) during EVA's. This capability is further augmented through the operational ability to 
shunt or feather the solar arrays. 

However, as the vehicle configuration matured, another source of charging became apparent: 
motion of the vehicle through the Earth's magnetic field (particularly near the Earth's poles) 
caused induced currents to flow through vehicle structure and create both positive and 
negative potentials that grew larger as the vehicle truss length grew longer. After much 
discussion, it was agreed that these positive potentials presented a significant electrical shock 
risk to EVA crewmembers, especially for EVA's requiring operations at or beyond the SARJ 
(Solar Alpha Rotary Joint) on the Truss. Modifications were made to the suit and to EVA 
hardware to provide insulation and prevent the EVA crewmember from becoming part of the 
potential circuit path. It has also been determined that this risk can be completely mitigated by 
changing the vehicle attitude prior to an EVA, by orienting the ISS with the Truss Segment 
perpendicular to the Earth (YVV). This reduces the magnetic flux-induced currents through the 
Truss, reducing potentials to acceptable levels. 
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